Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to connect to a remote device (which connect to my server on port 31200 via TCP) and while troubleshooting with ngrep I'm getting the following:

T(6) 2012/02/21 00:26:25.817525 -> [S]

T(6) 2012/02/21 00:26:25.817556 -> [AR]

Does anyone know what the [S] and [AR] stand for or where I can find further info, can't find anything after an hour of searching (my C is poor so can't look into the source of ngrep to figure things out)! Also would be good to know what the (6) stands for, I've read it's the subprotocol but what does it correspond to?


share|improve this question
up vote 2 down vote accepted

According to the ngrep source, the T denotes TCP, and the (6) is the unsigned decimal representation of the protocol itself (read from the packet) - so the notations are equivalent. The available protocols are:

  • T(6) - TCP
  • U(17) UDP
  • I(1) - ICMP
  • I(58) - ICMPv6
  • G(2) - IGMP
  • ? (unknown)

There is a lot more, but those are the only ones put out by ngrep.

The possibilities for the TCP flags are:

  • ACK [A]
  • SYN [S]
  • RST [R]
  • FIN [F]
  • URG [U]
  • PUSH [P]
  • ECE [E]
  • CWR [C]
share|improve this answer
Sorted, much appreciated! – kokonut Feb 22 '12 at 9:39
It's just amazing that this isn't documented anywhere... – Mei Feb 22 '12 at 15:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.